Add CycloneDX SBOM generation across all services

[jmolloy421]

• Add CycloneDX Gradle plugin to Java services (account-service, trade-service, position-service, trade-processor)
• Add CycloneDX dotnet tool configuration for .NET service (people-service)
• Add @cyclonedx/cyclonedx-npm to Node.js services (trade-feed, reference-data)
• Add SBOM generation scripts to web-front-end (Angular and React)

This enables automated Software Bill of Materials (SBOM) generation during the build process, supporting EO 14028 compliance and secure-by-design principles.

[netlify]

✅ Deploy Preview for lucky-concha-f3599f canceled.

Name	Link
🔨 Latest commit	e7f76ef
🔍 Latest deploy log	https://app.netlify.com/projects/lucky-concha-f3599f/deploys/69613c2c36063e0008ef1f7c

[netlify]

✅ Deploy Preview for lucky-concha-f3599f canceled.

Name	Link
🔨 Latest commit	e7f76ef
🔍 Latest deploy log	https://app.netlify.com/projects/lucky-concha-f3599f/deploys/69613c2c36063e0008ef1f7c

[linux-foundation-easycla]

• ❌ The email address for the commit (e7f76ef) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please submit a support request ticket.
• ❌ - login: @devin-ai-integration[bot] / name: Devin AI . The commit (e7f76ef) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via:

Co-authored-by: name <email>

Supported Co-authored-by: formats include:

1. Anything <id+login@users.noreply.github.com> - it will locate your GitHub user by id part.
2. Anything <login@users.noreply.github.com> - it will locate your GitHub user by login part.
3. Anything <public-email> - it will locate your GitHub user by public-email part. Note that this email must be made public on Github.
4. Anything <other-email> - it will locate your GitHub user by other-email part but only if that email was used before for any other CLA as a main commit author.
5. login <any-valid-email> - it will locate your GitHub user by login part, note that login part must be at least 3 characters long.

Please update your commit message(s) by doing git commit --amend and then git push [--force] and then request re-running CLA check via commenting on this pull request:

/easycla